Merge branch 'restrict_to_attributes_notificiation_setting' into 'master'

Restrict NotificationSetting#event_enabled? method to only attributes

See merge request gitlab-org/gitlab!38857

app/models/notification_setting.rb

@@ -97,7 +97,11 @@ class NotificationSetting < ApplicationRecord
   alias_method :fixed_pipeline?, :fixed_pipeline
 
   def event_enabled?(event)
-    respond_to?(event) && !!public_send(event) # rubocop:disable GitlabSecurity/PublicSend
+    # We override these two attributes, so we can't use read_attribute
+    return failed_pipeline if event.to_sym == :failed_pipeline
+    return fixed_pipeline if event.to_sym == :fixed_pipeline
+
+    has_attribute?(event) && !!read_attribute(event)
   end
 
   def owns_notification_email

spec/models/notification_setting_spec.rb

@@ -118,6 +118,46 @@ RSpec.describe NotificationSetting do
         expect(subject.event_enabled?(:foo_event)).to be(false)
       end
     end
+
+    describe 'for failed_pipeline' do
+      using RSpec::Parameterized::TableSyntax
+
+      where(:column, :expected) do
+        nil | true
+        true | true
+        false | false
+      end
+
+      with_them do
+        before do
+          subject.update!(failed_pipeline: column)
+        end
+
+        it do
+          expect(subject.event_enabled?(:failed_pipeline)).to eq(expected)
+        end
+      end
+    end
+
+    describe 'for fixed_pipeline' do
+      using RSpec::Parameterized::TableSyntax
+
+      where(:column, :expected) do
+        nil | true
+        true | true
+        false | false
+      end
+
+      with_them do
+        before do
+          subject.update!(fixed_pipeline: column)
+        end
+
+        it do
+          expect(subject.event_enabled?(:fixed_pipeline)).to eq(expected)
+        end
+      end
+    end
   end
 
   describe '.email_events' do